CVE-2026-53266: Linux Kernel Out-of-Bounds Write Vulnerability
Linux Kernel contains an out-of-bounds write vulnerability in the ebtables SNAT target which allows an ARP sender hardware address rewrite to write directly into a nonlinear socket-buffer fragment backed by a splice-imported file page. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.
Overview
The Linux kernel's ebtables SNAT target contains an out-of-bounds write flaw in the bridge netfilter path. When the SNAT target rewrites an ARP sender hardware address, it calls skb_store_bits() without first ensuring the target memory range is writable. If the relevant socket buffer fragment is backed by a splice-imported file page, the write goes directly into that read-only page, corrupting kernel memory. A local attacker who can configure ebtables SNAT rules and route ARP traffic through a bridge interface can exploit this to escalate privileges or crash the system. Kernel versions from 5.10 through the unpatched stable-branch boundaries are affected.
Vulnerability details
The ebtables SNAT target in net/bridge/netfilter/ebt_snat.c handles two distinct rewrite operations: an Ethernet source address rewrite, which is correctly guarded by skb_ensure_writable(), and an optional ARP sender hardware address (SHA) rewrite, which was not. The SHA rewrite calls skb_store_bits() at an offset into skb->data after only reading the ARP header via skb_header_pointer(). That read-only call does not promote the underlying fragment to a writable state. When the skb fragment covering the SHA range is backed by a splice-imported file page, the kernel writes a new MAC address directly into that page, an out-of-bounds write (CWE-787) into memory that was never made writable.
An attacker with a local, low-privilege account who can configure ebtables SNAT rules on a bridge interface arranges for ARP packets to traverse the bridge netfilter hook while the SHA range of the socket buffer sits in a nonlinear fragment backed by a splice-imported file page. When the SNAT target fires, skb_store_bits() corrupts that file-backed page. Successful exploitation can yield kernel memory corruption, leading to privilege escalation, arbitrary code execution in kernel context, or a system crash. The preconditions require local access and the ability to manipulate bridge netfilter rules, which typically implies CAP_NET_ADMIN or equivalent capability.
Severity and impact
Exploitation status
This vulnerability is confirmed as actively exploited in the wild — it is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
Detection and monitoring
- Monitor for unexpected ebtables SNAT rule creation on bridge interfaces, particularly rules added by non-root users or processes outside normal network-management tooling. Audit netfilter rule changes via auditd with rules targeting the nft or ebtables syscall paths.
- Watch for kernel oops, BUG(), or page-fault entries in /var/log/kern.log or the systemd journal (journalctl -k) referencing ebt_snat or skb_store_bits, which may indicate the vulnerable code path was triggered, whether intentionally or by a misconfigured rule.
Remediation
Additional hardening
- Update the Linux kernel to 5.10.259 or later in the 5.10 stable branch, or 5.15.210, 6.1.176, 6.6.143, 6.12.94, or 6.18.36 in their respective branches. See References for the vendor patch commits.
- Restrict CAP_NET_ADMIN to trusted processes and accounts. Unprivileged users should not be able to create or modify ebtables rules; audit user namespaces and container configurations that grant this capability implicitly.
- Disable or remove ebtables SNAT rules on bridge interfaces where ARP sender hardware address rewriting is not operationally required, reducing the attack surface to systems that actively use this feature.
- Where kernel updates cannot be applied immediately, restrict bridge netfilter processing by disabling the br_netfilter kernel module on hosts that do not require bridged packet filtering, preventing the vulnerable code path from being reached.
Key dates
References
- https://git.kernel.org/stable/c/153ea96c806aea395daba907a4f88480b6ad5093
- https://git.kernel.org/stable/c/67ba971ae02514d85818fe0c32549ab4bfa3bf49
- https://git.kernel.org/stable/c/76280b78cc9f23bdc6438e10ad6dff148ef8375b
- https://git.kernel.org/stable/c/afd64b59c3de9bbbdd3759e834fdc55cda716e0b
- https://git.kernel.org/stable/c/b18675263db1147c8e1cab625400c13a0d87bd2d
- https://git.kernel.org/stable/c/b7e91939ba9be805a62a257fa4e227dffbb88fa0
- https://git.kernel.org/stable/c/bf84ad7c7a9ede46e31afaa41a1ba06a159e8c87
- https://git.kernel.org/stable/c/c9b5ff59feffb92a147a84a5aa28acd2cb8ff4c5
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-53266
Frequently asked questions
Does CVE-2026-53266 affect my FedRAMP authorization?
If Linux Kernel runs inside your authorization boundary, yes. CVE-2026-53266 appears in CISA's Known Exploited Vulnerabilities (KEV) catalog, with a remediation deadline of September 21, 2026. For a FedRAMP-authorized service, an unpatched KEV within the boundary is an assessor finding. You must either remediate it or formally document a mitigation before your assessor and sponsoring agency raise it as a deficiency.
How does Knox help me handle CVE-2026-53266?
Knox does not patch your software. Remediating Linux Kernel is your responsibility under the FedRAMP shared-responsibility model. What Knox provides is the pre-authorized, single-tenant boundary to remediate within, plus Knox's automated continuous monitoring platform and audit-artifact coverage that document the fix for your next assessment. Applying the patch for CVE-2026-53266 is yours to execute; maintaining a defensible compliance posture while you do it is not something you manage alone.
How does Knox's monitoring help with vulnerabilities like this?
Knox's automated continuous monitoring platform watches your environment for newly disclosed vulnerabilities and compliance issues, including CVE-2026-53266. Exposure surfaces during ongoing monitoring rather than only when an assessor flags it at review time, giving you the lead time to act before a finding becomes a formal deficiency.
How do I get FedRAMP authorized with Knox?
Knox runs a FedRAMP-as-a-Service platform. It gives SaaS vendors a pre-authorized cloud boundary on AWS, Azure, and GCP. Your application inherits 60-80% of the required security controls. You reach FedRAMP authorization in about 90 days for roughly 90% less than the traditional $3.5M path. Book a meeting and Knox will map your path to authorization.
What happens if CVE-2026-53266 isn't remediated by September 21, 2026?
An unremediated CVE-2026-53266 becomes a Plan of Action and Milestones (POA&M) item. A growing POA&M list is what turns a routine continuous-monitoring review into a difficult conversation with your sponsoring agency. Closing the item out and documenting the remediation is what keeps your authorization clean and the agency relationship on solid footing.
Access continuous compliance
We never compromise on security. Meet with our team to discuss scope, readiness, and map your company’s accelerated path to government certification.
_Horizontal_RGB.png)
